Seeking assistance diagnosing frequent new ntoskrnl.exe memory dumps in Windows 10

nonplayer

Reputable
Dec 1, 2015
1
0
4,510
My Windows 10 machine has suddenly started getting frequent BSODs in the past few weeks, stemming from "ntoskrnl.exe." I did a mess of searching when it started happening, with a frequency of about once a day. I followed a lot of the tips I found on those searches, including installing both WinDBG and BlueScreenView, doing a full driver clean out of my nvidia drivers, and removing the Asus AICharger program. Additionally I put the latest Memtest86 on a flash drive and ran it without finding anything erroneous.

That seemed to have stopped it, and a week went by with nothing breaking.

Woke up this morning to yet another BSOD, and figured I'd finally post my own reports here and seek some deeper information.

I've tested the memory again, no errors. Virus scans with both Defender and MalwareBytes turn up negative.

I've got multiple dumps I can share, just not sure the exact format you need. Please let me know

My system specs are:
OS Name - Microsoft Windows 10 Pro (10.0.10586 Build 10586)
AMD FX-8370 Eight-Core Processor, 4335 Mhz, 4 Core(s), 8 Logical Processor(s)
ASUS SABERTOOTH 990FX R2.0 Motherboard
Installed Physical Memory (RAM) 16.0 GB (4x G.SKILL Ripjaws X Series 8GB (2 x 4GB) 240-Pin DDR3 SDRAM DDR3 1866)
POWER: System is connected to an APC Back-UPS RS 1500G, monitored locally using the Powerchute application
Hard Drives:
Root = 60g ssd
Extended:
- 2x 3TB drives in software Mirror RAID as storage and backup
- 1x 500g drive for user home folders, misc programs
- 1x 500g drive for games
- 1x 1TB drive for remote file serving

Please let me know if you need any further information or diagnostics. Thanks.

Using WinDBG I was able to get the following extended output, if it helps at all:


Code:
MODULE_NAME: nt

FAULTING_MODULE: fffff802baa14000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  56457780

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

FAULTING_IP: 
nt+6ef02
fffff802`baa82f02 48890a          mov     qword ptr [rdx],rcx

CONTEXT:  ffffd00033b85300 -- (.cxr 0xffffd00033b85300;r)
rax=0000000000000000 rbx=ffffe001255319c0 rcx=ffffd00033b85d80
rdx=9eaa800000000000 rsi=0000000000000000 rdi=ffffd00033b85d80
rip=fffff802baa82f02 rsp=ffffd00033b85d20 rbp=ffffe001277eb080
 r8=ffffd00033b85de0  r9=0000000000000000 r10=0000000000000000
r11=0000000000800000 r12=0000000000000000 r13=ffffd00033b86840
r14=0000000000000001 r15=0000000000010001
iopl=0         nv up di ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010086
nt+0x6ef02:
fffff802`baa82f02 48890a          mov     qword ptr [rdx],rcx ds:002b:9eaa8000`00000000=????????????????
Last set context:
rax=0000000000000000 rbx=ffffe001255319c0 rcx=ffffd00033b85d80
rdx=9eaa800000000000 rsi=0000000000000000 rdi=ffffd00033b85d80
rip=fffff802baa82f02 rsp=ffffd00033b85d20 rbp=ffffe001277eb080
 r8=ffffd00033b85de0  r9=0000000000000000 r10=0000000000000000
r11=0000000000800000 r12=0000000000000000 r13=ffffd00033b86840
r14=0000000000000001 r15=0000000000010001
iopl=0         nv up di ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010086
nt+0x6ef02:
fffff802`baa82f02 48890a          mov     qword ptr [rdx],rcx ds:002b:9eaa8000`00000000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x3B

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre

LAST_CONTROL_TRANSFER:  from ffffd00033b85f40 to fffff802baa82f02

STACK_TEXT:  
ffffd000`33b85d20 ffffd000`33b85f40 : ffffe001`25bff610 ffffd000`33b860a0 fffff901`400c3010 ffffd000`33b85f00 : nt+0x6ef02
ffffd000`33b85d28 ffffe001`25bff610 : ffffd000`33b860a0 fffff901`400c3010 ffffd000`33b85f00 fffff802`baa604bf : 0xffffd000`33b85f40
ffffd000`33b85d30 ffffd000`33b860a0 : fffff901`400c3010 ffffd000`33b85f00 fffff802`baa604bf ffffe001`255319c0 : 0xffffe001`25bff610
ffffd000`33b85d38 fffff901`400c3010 : ffffd000`33b85f00 fffff802`baa604bf ffffe001`255319c0 00000000`00000001 : 0xffffd000`33b860a0
ffffd000`33b85d40 ffffd000`33b85f00 : fffff802`baa604bf ffffe001`255319c0 00000000`00000001 ffffd000`33b85e02 : 0xfffff901`400c3010
ffffd000`33b85d48 fffff802`baa604bf : ffffe001`255319c0 00000000`00000001 ffffd000`33b85e02 00000000`00000000 : 0xffffd000`33b85f00
ffffd000`33b85d50 ffffe001`255319c0 : 00000000`00000001 ffffd000`33b85e02 00000000`00000000 ffffe001`25bff610 : nt+0x4c4bf
ffffd000`33b85d58 00000000`00000001 : ffffd000`33b85e02 00000000`00000000 ffffe001`25bff610 fffff960`7aba165f : 0xffffe001`255319c0
ffffd000`33b85d60 ffffd000`33b85e02 : 00000000`00000000 ffffe001`25bff610 fffff960`7aba165f 00000000`00000000 : 0x1
ffffd000`33b85d68 00000000`00000000 : ffffe001`25bff610 fffff960`7aba165f 00000000`00000000 ffffe001`25531a21 : 0xffffd000`33b85e02


FOLLOWUP_IP: 
nt+6ef02
fffff802`baa82f02 48890a          mov     qword ptr [rdx],rcx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+6ef02

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

STACK_COMMAND:  .cxr 0xffffd00033b85300 ; kb

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  WRONG_SYMBOLS

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:wrong_symbols

FAILURE_ID_HASH:  {70b057e8-2462-896f-28e7-ac72d4d365f8}
 
Solution

You are on the right track With Nvidia drivers, however some problems with ntoskrnl.exe concern Superfetch. Disable it in Services and see if that helps. Mine only used 175MB of RAM, but HDD use was excessive.
 
Solution